What is GHSA-4x35-vr82-xvj6?

GHSA-4x35-vr82-xvj6 is a security advisory published by GitHub Security Advisories with High severity. SQL Injection in AssetController

Which CVE IDs does GHSA-4x35-vr82-xvj6 cover?

GHSA-4x35-vr82-xvj6 covers the following CVE IDs: CVE-2023-2338. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4x35-vr82-xvj6?

GHSA-4x35-vr82-xvj6 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-4x35-vr82-xvj6?

GHSA-4x35-vr82-xvj6 affects 1 product, including: composer/pimcore/pimcore:\u003c 10.5.21.

GHSA-4x35-vr82-xvj6HighCVSS 8.8

SQL Injection in AssetController

Vendor

GitHub Security Advisories

Published

April 27, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-2338 →

📋 Description

Impact

SQL injections in AssetController due to unsanitized concatenating strings in where clause. The attacker can dump database, alter data or perform dos on the backend database.

Patches

Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520.patch

Workarounds

Apply patch https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520.patch manually.

References

https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462/

🎯 Affected products1

composer/pimcore/pimcore:< 10.5.21

🔗 References (5)

https://github.com/pimcore/pimcore/security/advisories/GHSA-4x35-vr82-xvj6
https://nvd.nist.gov/vuln/detail/CVE-2023-2338
https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520
https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462
https://github.com/advisories/GHSA-4x35-vr82-xvj6